Tan Chew Keong in his Win2K/XP SDT Restore 0.1 uses a simple way to find changed SDT entries - he just compares SDT from memory with SDT from ntoskrnl.exe file, assuming that KeServiceDescriptorTable.Base is not changed. If it is, Tan's code that locates KiServiceTable on disk will fail when KeServiceDescriptorTable.Base points somewhere outside the ntoskrnl.
I've found a way how to locate original KiServiceTable in the ntoskrnl file even if KeServiceDescriptorTable.Base has been changed. Method works both in the user mode and in the kmode.
This may be useful to bypass SDT-patching hooks, and not only to restore old SDT. For example, KAV uses SDT relocation ;)
KeServiceDescriptorTable is initialized by KiInitSystem():
KeServiceDescriptorTable[0].Base = &KiServiceTable[0]; KeServiceDescriptorTable[0].Count = NULL; KeServiceDescriptorTable[0].Limit = KiServiceLimit; KeServiceDescriptorTable[0].Number = &KiArgumentTable[0]; for (Index = 1; Index < NUMBER_SERVICE_TABLES; Index += 1) { KeServiceDescriptorTable[Index].Limit = 0; }
Thus, we can find KiServiceTable by examining all xrefs to KeServiceDescriptorTable in the kernel. We will search for
It's easy to find KeServiceDescriptorTable xrefs by scanning the code, but this is dangerous and time-consuming. It's better to use ntoskrnl's relocation information - it is always present in all nt systems. This "mov [mem32], imm32" instruction will have 2 relocs pointing in it, and the second is the one we're searching for. So, the usermode code will do these steps:
1. Load ntosknrl as a dll. 2. Locate KeServiceDescriptorTable - it is exported. 3. Enumerate all relocations to find xrefs to the KeServiceDescriptorTable. 4. Check these opcodes to be a "mov [mem32],imm32". 5. Get KiServiceTable - it's offset is +6 from the opcode beginning.
The example code dumps KiServiceTable data from file and does no comparings with the existing sdt.
So, it's a must to a SDT-patching rootkit to hook file system and show "patched" version of ntoskrnl to all readers. And of course, services hooks code must reside in the ntoskrnl region and have no codepaths outside it. Otherwise it may be tracked in seconds.
// loop thru relocs to speed up the search if ((poh->DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress) && (!((pfh->Characteristics)&IMAGE_FILE_RELOCS_STRIPPED))) {
for (i=0;i<(pbr->SizeOfBlock-sizeof(IMAGE_BASE_RELOCATION))>>1;i++,pfe++) { if (pfe->type==IMAGE_REL_BASED_HIGHLOW) { dwFixups++; dwPointerRva=pbr->VirtualAddress+pfe->offset; // DONT_RESOLVE_DLL_REFERENCES flag means relocs aren't fixed dwPointsToRva=*(PDWORD)((DWORD)hModule+dwPointerRva)-(DWORD)poh->ImageBase;
// does this reloc point to KeServiceDescriptorTable.Base? if (dwPointsToRva==dwKSDT) { // check for mov [mem32],imm32. we are trying to find // "mov ds:_KeServiceDescriptorTable.Base, offset _KiServiceTable" // from the KiInitSystem. if (*(PWORD)((DWORD)hModule+dwPointerRva-2)==0x05c7) { // should check for a reloc presence on KiServiceTable here // but forget it dwKiServiceTable=*(PDWORD)((DWORD)hModule+dwPointerRva+4)-poh->ImageBase; return dwKiServiceTable; } }
} else if (pfe->type!=IMAGE_REL_BASED_ABSOLUTE) // should never get here printf("\trelo type %d found at .%X\n",pfe->type,pbr->VirtualAddress+pfe->offset); } *(PDWORD)&pbr+=pbr->SizeOfBlock; } }
if (!dwFixups) // should never happen - nt, 2k, xp kernels have relocation data printf("No fixups!\n"); return 0; }
// get system modules - ntoskrnl is always first there rc=NtQuerySystemInformation(SystemModuleInformation,pModules,4,&dwNeededSize); if (rc==STATUS_INFO_LENGTH_MISMATCH) { pModules=GlobalAlloc(GPTR,dwNeededSize); rc=NtQuerySystemInformation(SystemModuleInformation,pModules,dwNeededSize,NULL); } else { strange: printf("strange NtQuerySystemInformation()!\n"); return; } if (!NT_SUCCESS(rc)) goto strange;
// imagebase dwKernelBase=(DWORD)pModules->smi.Base; // filename - it may be renamed in the boot.ini pKernelName=pModules->smi.ModuleNameOffset+pModules->smi.ImageName;
// map ntoskrnl - hopefully it has relocs hKernel=LoadLibraryEx(pKernelName,0,DONT_RESOLVE_DLL_REFERENCES); if (!hKernel) { printf("Failed to load! LastError=%i\n",GetLastError()); return; }
GlobalFree(pModules);
// our own export walker is useless here - we have GetProcAddress :) if (!(dwKSDT=(DWORD)GetProcAddress(hKernel,"KeServiceDescriptorTable"))) { printf("Can't find KeServiceDescriptorTable\n"); return; }
// get KeServiceDescriptorTable rva dwKSDT-=(DWORD)hKernel; // find KiServiceTable if (!(dwKiServiceTable=FindKiServiceTable(hKernel,dwKSDT))) { printf("Can't find KiServiceTable...\n"); return; }
// MAY FAIL!!! // should get right ServiceLimit here, but this is trivial in the kernel mode GetHeaders((PBYTE)hKernel,&pfh,&poh,&psh);
for (pService=(PDWORD)((DWORD)hKernel+dwKiServiceTable); *pService-poh->ImageBase<poh->SizeOfImage; pService++,dwServices++) printf("%08X\n",*pService-poh->ImageBase+dwKernelBase);